RFP Attachment L-4_CoreSus_Task_Order_PWS.pdf

M95494-22-R-0013 RFP Attachment L-4

Performance Work Statement for Sample Task Order 1, Core Sustainment

1.0 Background

The Technology Services Organization (TSO) operates and sustains several mature United States Marine Corps (USMC) Business Information Systems (BISs). TSO is responsible for several layers of Information Technology (IT) in support of its BISs, from the infrastructure level through the software application layers.

1.1 Scope

This Task Order (TO) will provide sustainment services as defined in Section 2.0 to a subset of TSO BIS and business processes. The following BISs are within scope of this TO as indicated in each subsection of Section 2.0.

1.1.1 Product Systems

The following systems are the primary product of the TSO, providing pay, manpower, and accounting services to Marines, civilian Marines, and other users:

1. Automated Performance Evaluation System (APES) – APES is the USMC BIS for creating, processing, and reviewing the fitness reports (FITREPs) of senior enlisted Marines above the E-5 level and Marine officers. The system’s user base consists of Marines as well as their reporting seniors and reviewing officers.

2. Marine Corps Total Force System (MCTFS) – MCTFS is the integrated pay and personnel system for active duty and reserve Marines, and the authoritative source of data for all Marine Corps pay and personnel information consisting of over 500,000 records.

3. Models – Models is the USMC BIS for creating, manipulating, and viewing force structure models and manpower data sets. This BIS is leveraged by personnel within Manpower and Reserve Affairs (M&RA) Department, Headquarters Marine Corps (HQMC).

4. Marine Online (MOL) – MOL is the web-based counterpart of MCTFS, providing pay and personnel data to over 160,000 unique web users every month.

5. Optical Data Imaging – Records Management System (ODI-RMS) – ODI-RMS provides HQMC, M&RA, MMRP personnel a means for storing, requesting, viewing, correcting, retiring, and loaning Official Military Personnel Files (OMPFs). ODI-RMS is the authoritative data source for all USMC performance evaluation and promotion functions. ODI-RMS also provides promotion and selection board support for

HQMC.

6. Requirements Transition and Manpower Management System (RTAMMS) – RTAMMS is the USMC BIS for the manpower management of Marine reservists. The BIS consist of three modules for managing reserve drills, medical entitlements, and inventory management.

7. Total Force Retention System (TFRS) – TFRS is the USMC BIS for retaining (reenlisting or extending) or reclassifying active duty and active reserve Marine personnel. The system’s user base consists of Marines.

8. Total Force Data Warehouse (TFDW) – TFDW is the USMC BIS for storing and retrieving historical manpower data. The system serves as the single, authoritative source to satisfy Congressional and DoD mandated end strength reporting requirements, to provide decision-support capabilities, and to provide analytical capabilities to enable business process insight, analysis and improvement.

9. Web-based Manpower Assignment Support System (WebMASS) – WebMASS is the USMC BIS for managing active duty and active reserve Marine personnel assignments, conducting financial management and analysis related to Permanent Change of Assignment (PCA) and Permanent Change of Station (PCS) budgeting, and providing hard copies of orders to enable individual Marines to complete administrative requirements to execute household shipments. This BIS is leveraged by assignment personnel within M&RA Department, HQMC.

1.1.2 Infrastructure Systems

The following systems provide the infrastructure on which TSO BISs reside and on which TSO team members sustain and manage BIS products and services.

1. TSO Application Development and Test Environment (ADTE) – TSO ADTE provides a secure environment for the sustainment and test of TSO software. It consists of virtual workstations, test servers, and some build automation tools—precursors of a full Continuous Integration/Continuous Development (CI/CD) pipeline.

2. TSO Project Management Services (PjMS)– TSO PjMS provides TSO and its partners with web-based tools including Atlassian Software Development Lifecycle (SDLC) tools and Splunk log management tools.

3. TSO Production – TSO Production encapsulates the servers, network, operating systems (OSs), and other infrastructure components on which web-based TSO BIS reside.

2.0 Tasks

In accordance with Section 2.0 of the Performance Work Statement (PWS) under the base Contract, the Contractor shall perform the following tasks. Unless otherwise specified, all deliverables other than software source code will be delivered to TSO via a Jira ticket associated with the tasking. Software source code shall be delivered via check-in to government furnished software repositories.

2.1 Web BIS Infrastructure and Operations (Base Contract PWS 2.2)

2.1.1 TSO Production Support

The Contractor shall provide server and middleware support for the TSO Production BIS. This BIS consists of nearly 500 virtual/physical Linux and Windows servers in a traditional data center and in a cloud environment. TSO defines middleware software as Commercial off the Shelf (COTS) or Government off the Shelf (GOTS) software that lies between the OS and the traditional software application layer, such as Oracle Weblogic, Oracle Hypertexts Transport Protocol (HTTP) Server (OHS), and IBM Analytics.

The Contractor shall:

1. Monitor servers and connections for performance and functionality issues. Monitoring is partially automated, but some manual checks are required. Manual work is performed during normal business hours.

2. Troubleshoot application server issues as necessary, including business hours and on-call, after-hours support.

3. Provide X.509 certificate management support, to include creating, issuing, monitoring expiration of, and renewing X.509 certificates for TSO infrastructure.

4. Attend the weekly Configuration Management and Change Management meetings;

5. Execute software patching and upgrading—including Information Assurance Vulnerability Management (IAVM), Marine Collections Databased (MCD) tasks, and Common Vulnerability and Exposures (CVEs) on middleware software, in coordination with BIS Release Management (RM) teams and the TSO Change Manager.

6. Provide password management support in compliance with security, TSO, Manpower & Reserve Affairs (M&RA) and Hybrid Cloud Services (HCS) requirements. This workload typically occurs annually, but may be required as part of incident management.

7. Provide scheduled after-hours support to perform upgrades and patching activities.

8. Implement and monitor secure hardening of servers per Defense Information Systems Agency (DISA)

Security Technical Implementation Guide (STIG), Security Requirements Guide (SRG), vendor security recommendations, and USMC/TSO guidance;

9. Implement middleware software following engineer/architect guidelines and document any configuration changes required; On average this task occurs four (4) times per year.

10. Provide touch labor for TSO managed assets within the Kansas City IT Center (KCITC) data center, to include physical access to the KCITC to manually activate/deactivate equipment, direct physical console access to hardware, and escort of 3rd party vendors into the controlled environment. Historically this type of support is needed four times per year, but response time within two (2) hours of notice is required for unscheduled support.

2.1.2 Web Database Administration Support

The Contractor shall provide database administration support for the APES, MOL, ODI-RMS, RTAMMS, TFRS, TFDW, and WebMASS BISs. These systems utilize approximately sixty (60) Oracle Database and Oracle Real Application Clusters (RAC) databases across multiple environments in TSO ADTE and TSO Production.

Approximately one thousand (1,000) Jira tickets with the following scope will be issued per year.

1. Install & maintain Database infrastructure as required based upon engineering requirements

2. Perform Software patching/upgrades (including IAVMs, MCDs & CVEs) on Relational Database

Management System (RDBMS) software coordinating scheduling with MOL Release Management (RM).

Document any configuration changes required.

3. Configure & Deploy database servers following all Department of Defense (DoD), Marine Corps, and TSO requirements, policy, and guidance.

4. Monitor and manage storage space, perform capacity planning, performance tuning, and system health as necessary.

5. Configure and maintain RAC and logical/physical dataguard instances as necessary.

6. Execute database scripts in support of application releases, database anomalies, and production fixes.

7. Refresh data in testing environments upon request.

8. Provide after-hours support when necessary to perform upgrades, deploy releases, and troubleshoot production issues.

9. Implement & monitor secure hardening of database servers per STIG, SRG, and USMC/TSO guidance.

10. Provide clean audit and validation support when necessary to answer data calls and other requests for information.

11. Develop, execute, and monitor backup and recovery procedures supporting clean audit and validation requirements.

2.2 Mainframe BIS Operations (Base Contract PWS 2.6)

The Contractor shall provide mainframe BIS operations support for the MCTFS BIS.

2.2.1 Mainframe Production Control Support

The Contractor shall provide mainframe production control support seven days per week, every week of the year.

1. Develop Software Release (SR) spreadsheet of jobs which will be utilized throughout each release.

2. Maintain all daily/weekly/monthly/on-request Job Control Language (JCL) jobs as directed via Jira tickets.

MCTFS runs approximately 1,343 jobs per day across multiple break fix, test, and production environments.

3. Design, test, and implement changes as needed.

4. Provide Tier 2 release management support utilizing the Treehouse Software N2O application.

5. Monitor and troubleshoot issues with batch jobs following TSO production control documentation.

6. Provide daily status reports via Jira or e-mail.

2.2.2 Mainframe Data Base 2 (DB2) Support

1. Provide daily monitoring of database reports and report events and incidents using the TSO-provided Key Performance Indicators (KPIs).

2. Follow up on findings discovered during the database monitoring process utilizing the TSO incident and event reporting processes.

3. Store audit artifacts as directed via Jira ticket into the TSO Audit document repository.

4. Perform necessary database maintenance such as run status commands (RUNSTATs), image copies, reorganization commands (REORGs), monitoring database size, troubleshooting database issues, etc. as requested in Jira tickets and provide documented results to the requestor via Atlassian Suite (Jira, Confluence).

5. Perform database refresh and copy data to sustainment and test databases as requested.

6. Complete incoming Database Administrator (DBA) tickets in Jira and, for email requests from groups unable to submit tickets via Jira, write a Jira ticket to support the request.

7. Perform performance tuning.

8. Monitor storage capacity and recommend increases as needed.

9. Determine if file mods impact any normal DBA processes or jobs.

10. Provide natural security administration Tier 1 support.

11. Provide account management in accordance with Terminal Area Security Office (TASO) Jira tickets.

12. Investigate and resolve issues with data (e.g. missing, file formats, permissions, etc.).

13. Perform Access request function for the Mainframe DBA and Data Analysis (DA) groups.

14. Create Account ID for new users, delete users when appropriate, and perform password resets and remove suspensions when requested.

15. Perform cyclic and regulatory bulletin updates to the Business Systems Incorporated (BSI) Tax Factory software running on the TSO mainframe. Updates are downloaded from the BSI website and are effected within the mainframe per vendor and USMC instructions. Such updates are driven by updates to tax law and regulations, and occur once per quarter on average.

2.2.3 Mainframe Engineering Support

1. Troubleshoot security and other problems as reported.

2. Perform performance tuning.

3. Provide TSO technical support for Report.Web.

4. Create and monitor batch jobs to send reports to Report.Web.

5. Investigate issues within Report.Web such as access or missing reports.

6. Facilitate reports being defined and populated on server (Report.Web).

7. Maintain the log for additions/deletions of reports.

8. Provide technical input for System Interface Agreements (SIAs), Memorandum of Agreement (MOAs), and network diagrams.

9. Provide input and execute Requests for Assistance (RFAs).

10. Maintain Information Management System (IMS) in-house documents for historical purposes.

11. Analyze current security configurations and attach a written report to the applicable Jira tickets. Make formal recommendations through the Mainframe Engineering team for modifications when necessary.

12. Troubleshoot security issues and determine the necessary corrections.

2.2.4 General support for all three major tasks above

1. Provide lessons learned and update Confluence “How To” documents within Confluence Team pages as needed.

2. Create and update existing process and system documentation in the MCTFS document repository, providing the final documents to the government via the applicable Jira tickets.

3. Troubleshoot security and other problems as reported.

4. Provide design, programming, and testing assistance to system sustainment teams.

5. Attend regularly scheduled team meetings and any other meetings as assigned. Regular scheduled meetings include daily scrum meetings, weekly engineering and release meetings.

2.3 Data and Platform Analysis (Base Contract PWS 2.4)

The Contractor shall provide Business Intelligence (BI) engineering support for the MOL BIS. The Contractor shall perform the following tasks during each 2 week sprint for MOL (1 database) within the IBM Cognos Analytics and Planning Analytics components of MOL.

1. Provide data mapping services, to include documenting database interconnectivity, for delivery to system owners.

2. Provide BI data modeling within TSO-provided tools, with the end deliverable remaining in the tool for system owner use.

3. Provide BI report authoring via TSO-provided tools, with the end deliverable remaining in the tool for system owner use.

4. Provide technical documentation on BI tool and database content, for delivery to system owners.

5. Provide BI tool administration to include configuration changes.

6. Provide BI tool software patching on a monthly basis.

2.4 Financial Audit Support (Base Contract PWS 2.5)

2.4.1 Audit Requests (PBC/FUQ/Samples/OBS/Draft NFR)

The Contractor shall review the following types of Audit Requests for the MCTFS, MOL, and TSO Production BISs.

Audit Request Type Anticipated Audit Requests per Year Provided by Client (PBC) 190 Follow-Up Questions (FUQ) 22 Samples 55 Observations (OBS) 11 Notification of Findings Report (NFR) 25 Site Visit PBC 192

The Contractor shall build tasks in the TSO’s SharePoint Audit Tracker. The Contractor shall review the supporting documentation (artifacts) provided by stakeholders, utilizing the audit tracking tool built in to TSO’s Audit Tracker and deliver them by the corresponding due date which is set by the Independent Public Accountant (IPA). The Contractor shall conduct quality control (QC) on artifact coversheets to ensure accuracy and standardization of TSO stakeholder-provided information. The Contractor shall perform any corrections and coordinate updates with internal and external stakeholders. The Contractor shall monitor and track PBC requests in the DON Audit Response Center (ARC) for TSO stakeholders and process requests for clarification or extensions.

2.4.2 Audit Remediation (Corrective Action Plan (CAP))

The Contractor shall coordinate meetings and collaborative sessions with TSO stakeholders and Risk and Compliance Branch (RFK) CAP Coaches to provide guidance in CAP development. The Contractor shall track progress and completion of CAP packages utilizing the TSO’s Audit Tracker. The Contractor shall provide weekly reports on status and progress of stakeholder milestones. The Contractor shall upload all TSO stakeholder-provided artifacts to the Navy’s Deficiency Tracking Tool (DTT) as they are received from the internal stakeholders.

Anticipated CAPs per year: 8

2.4.3 Audit Site Visits

The Contractor shall support the planning, scheduling, and coordination of resources in support of the IPA as well as external and internal stakeholder audits. The Contractor shall: attend and moderate approximately two stakeholder- IPA site visits; run meeting agendas; capture action items and PBCs; and report daily on the PBC roll-up.

2.4.4 Status Updates/Meetings

The Contractor shall attend and advocate for TSO during approximately three weekly Audit and Compliance meetings with internal and external stakeholders, which include: Risk Management Team (RMT); IPA; and Defense Finance and Accounting Service (DFAS). The Contractor shall produce meeting minutes and memoranda, as required. The Contractor shall record and track action items for all meetings conducted under this TO via meeting Memorandum for Records (MFRs). The Contractor shall upload and properly file all meeting deliverables to the TSO’s Audit Tracker. The Contractor shall coordinate and schedule meetings with internal and external stakeholders, including the IPA, as requested; send out invites, agendas and attachments to participants. Coordinate and schedule meetings with internal and external entities as requested; send out invites, agendas and attachments to participants.

2.4.5 Metrics and Reporting

The Contractor shall compile pertinent data for audit support service requests via TSO’s Audit Tracker. The Contractor shall develop weekly reports and metrics for the data and be prepared to present the collected information to leadership via briefings. The Contractor shall perform daily reviews of audit support service requests, assign requests to designated points of contact, and track the progress to ensure proper response and closure according to TSO processes. The Contractor shall conduct peer reviews of TSO audit support policy and procedure documents.

2.4.6 Audit and Compliance Support

TSO audit support documentation and Knowledge Base reviews are typically conducted via Microsoft Teams. The Contractor shall participate in these reviews and provide recommendations on process improvements, metrics, reporting, collaboration efforts, and points of contact. The recommendations shall include research references (e.g., applicable precedence) and ensure audit compliance.

The Contractor shall manage the peer review process of TSO audit support documentation also ensuring format and classification markings, are in accordance with Secretary of the Navy Instruction 5216.7 and DoD Instruction (DoDI) 5200.48, Controlled Unclassified Information (CUI), prior to submission to stakeholders as applicable. The Contractor shall monitor all documents within the review process and report on any critical issues or delays.

The Contractor shall compile pertinent data for TSO audit support tools and trackers and develop briefings on business use cases and tool improvements.

The Contractor shall submit support tickets to Jira or the Enterprise Service Desk, as appropriate, to implement tool changes and updates.

The Contractor shall provide training to new government and Contractor employees, as needed, on TSO audit support established processes, procedures, and policies.

2.5 Cybersecurity (Base Contract PWS 2.3)

The Contractor shall provide independent validation the following BISs during the indicated dates.

BIS Date of Commencement Date of Completion

MCTFS 11/21/2022 01/20/2023

TSO Production 01/30/2023 03/21/2023 TSO PjMS 07/05/2023 09/08/2023

This task shall be executed by a Marine Corps Validator approved by the Marine Corps Service Security Control Assessor as outlined in the USMC Enterprise Cybersecurity Manual 018, Marine Corps Assessment and Authorization Process (MCAAP).

The Contractor shall develop appropriate test procedures, execute test procedures, and accurately document the BISs’ security postures within Marine Corps Certification and Accreditation Support Tool (MCCAST) in accordance with MCAAP. The Contractor shall leverage MCCAST approved artifacts/templates/test plans and provide required supporting documentation per MCAAP.

The Contractor shall conduct a validation kick-off meeting with the TSO Information System Security Manager (ISSM) and other TSO staff at the beginning of the validation period. The Contractor shall conduct a validation close-out meeting with the TSO ISSM and other TSO staff at the conclusion of the validation period.

The Contractor shall provide the following deliverables to TSO via MCCAST:

1. Checklist files generated by the DISA STIG Viewer software tool for the BISs’s required STIG and SRG implementations.

2. Assured Compliance Assessment Solution (ACAS) scan result files

3. A Plan of Actions and Milestones (POA&M) with any outstanding findings and Common Vulnerability

Scoring System (CVSS) scores.

4. A complete Security Assessment Report (SAR) as generated by MCCAST.

5. Weekly status reports provided to the ISSM.

3.0 Administrative Tasks

Performance under this Task Order shall be tracked and reported in accordance with Section 3.3 and 3.5 of the PWS under the base Contract.

4.0 Place of Performance

The preponderance of the work will be performed at a Contractor facility. However, the task identified in Section

2.1.1.10 requires in-person, on-call support at KCITC Government facility in Kansas City, MO.

5.0 Period of Performance

The anticipated period of performance is as follows:

Period of Performance Date of Commencement Date of Completion Base 11/14/2022 11/13/2023

Option One 11/14/2023 11/13/2024 Option Two 11/14/2024 11/13/2025

Option Three 11/14/2025 11/13/2026 Option Four 11/14/2026 11/13/2027

6.0 Key Personnel

In accordance with Section 6.0 of the Contract, the Key Personnel assigned to this Task Order are considered to be essential to the work being performed. The Government prefers these key personnel to meet or exceed the following criteria:

• Senior Mainframe Systems Engineer – The Senior Mainframe Systems Engineer is responsible for analyzing, planning, designing, and documenting application installation and operations within a z/OS based mainframe BISs. The Senior Mainframe Systems Engineer leads infrastructure planning, application support, infrastructure analysis and assessment, and infrastructure test and troubleshooting.

o Experience:

10 years or more in engineering and operating z/OS based mainframe BISs 5 years or more integrating COBOL/CICS applications into z/OS environments.

2 years or more in engineering systems within the constraints of the MCAAP or other Risk

Management Framework implementations.

Experience in concept exploration, requirements definition, analysis, process design, systems design, integration testing and evaluation within complex environments.

Experienced in development of operational and system level architecture views.

• Senior Mainframe Application Engineer – The Senior Mainframe Application Engineer is responsible for analyzing, planning, designing, and documenting changes to mainframe software applications written in COBOL that execute in a batch or online CICS environment within a z/OS based environment. The mainframe application engineer formulates or updates BIS architectures and assists mainframe software sustainers with the implementation and test of architectures.

o Experience:

6 years or more in engineering enterprise-scale mainframe software applications 6 years or more implementing and updating DoD pay and personnel business rule logic.

4 years or more in engineering systems within the constraints of the MCAAP or other Risk

Management Framework implementations.

Experienced in development of operational and system level architecture views.

• Audit Support Analyst – The Audit Support Analyst is responsible for accomplishing financial audit support tasks in support of the internal and external stakeholders for the financial audit. The Audit Support Analyst oversees the audit support, which includes: receiving, tasking and managing audit requests, scheduling and taking part of audit support related meetings, site visit planning, management and reporting of audit support metrics, assisting in development and tracking of corrective action plans (CAPs) and updating and tracking of audit support processes and procedures.

o Education / Certifications: Bachelor’s Degree in IT related field or the below experience o Experience:

3 years or more working in IT related fields;

3 years or more proving customer support in an IT field;

1 year or more working with TSO supported BISs;

Ability to lead and support audit support stakeholders support needs through the audit support life cycle.

Experienced in working with Microsoft SharePoint and Jira.

• Marine Corps Validator – The Marine Corps Validator is responsible for independently validating TSO BISs on behalf of the Marine Corps Service Security Control Assessor.

o Education / Certifications: Designated a Marine Corps Validator by the Marine Corps Service Security

Control Assessor.

o Experience:

5 years creating and maintaining DoD Assessment and Authorization packages based upon the National Institute of Standards and Technology Risk Management Framework .

2 years validating Marine Corps Assessment and Authorization packages in accordance with the

MCAAP.

Ability to communicate technical details clearly and effectively via written and oral means.

Ability to effectively manage stakeholder expectations and demands, including TSO cybersecurity personnel and Security Control Assessor Analysts within Information Department, Headquarters Marine Corps.

6.1 Substitution of Key Personnel

Substitution of Key Personnel shall be in accordance with Section 6.1 of the Contract.

7.0 Personnel, Training, and Certification Requirements

Personnel, Training, and Certification Requirements shall be in accordance with Section 7.0 of the Contract.

For this TO, personnel supporting tasks in Sections 2.1, 2.2.2, 2.2.3, 2.3 must meet Information Assurance Technical (IAT) Level II baseline certification requirements and provide evidence of technical training in their technical domain within the past 364 days.

8.0 Task Order Management

This task order will be managed in accordance with Section 8.0 of the Contract.

9.0 Performance Requirements Summary (PRS)

The Contractor shall be evaluated in accordance with Section 9.0 of the Contract.

10.0 Government Furnished Equipment and Information

10.1 Government Furnished Equipment (GFE)

No GFE under this Task Order.

10.2 Government Furnished Information (GFI)

In addition to the requirements set forth in Section 10.2 of the Contract, the following For Official Use Only documents shall be provided as GFI

1. USMC Enterprise Cybersecurity Manual 018, MCAAP

11.0 Clearance, Access, and Security Requirements

Clearance, Access, and Security Requirements shall be in accordance with Section 11.0 of the Contract.

12.0 Privacy Act and HIPAA

All services performed relative to the requirements identified in this PWS allow access to unclassified or sensitive information covered by the Privacy Act of 1974 and other DoD and USMC regulations. Some information provided by the Contractor during the application process may be subject to the Health Insurance Portability and Accountability Act (HIPAA).

13.0 Travel

Travel under this Task Order shall be in accordance with Section 13.0 of the Contract. TSO estimates that twenty

(10) trips averaging four (4) days per trip will be required to Indianapolis, IN and (10) trips averaging four (4) days per trip will be required to Quantico, VA to support technical collaboration sessions that cannot be effectively accomplished via remote means.

14.0 Non-Personal Services

Contractor employees performing services under this contract and its Task Orders will be controlled, directed, and supervised at all times by Contractor management personnel. Contractor management shall ensure all employees comply with the performance work standards outlined in this PWS. Contractor employees shall perform their duties independent of, and without the supervision of, any Government official or other Defense Contractor. The tasks, duties, and responsibilities set forth in this PWS shall not be interpreted or implemented in any manner that results in any Contractor employee creating or modifying federal policy, obligating the appropriated funds of the United States Government, overseeing the work of federal employees, providing direct personal services to any federal employee, or otherwise violating the prohibitions set forth in Subparts 7.5 and 37.1 of the Federal Acquisition Regulation (FAR). The Government will grant Contractor access to the facilities and will perform the inspection and acceptance of the completed work.